New 0-Day Attacks Linked to China’s ‘Volt Typhoon’
Summary: Attackers are exploiting a zero-day in Versa Director, a product used by ISPs and MSPs, with a patch fixed in version 22.1.4 or later per Versa's August 26 advisory for CVE-2024-39717. Black Lotus Labs identified a web-based backdoor on Versa Director systems at four U.S. victims and one non-U.S. victim in the ISP and MSP sectors, with the earliest known exploit at a U.S. ISP on June 12, 2024, and assessed with medium confidence that Volt Typhoon was responsible.
What you should know: U.S. agencies assess with high confidence that Volt Typhoon is pre-positioning on IT networks to move laterally to OT assets and disrupt functions, and Versa Director sits at ISPs and MSPs whose downstream customers may never see the intrusion themselves.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-39717
- Related
- CVE-2024-39717: Versa Director Dangerous File Type Upload Vulnerability Known Exploited Vulnerabilities · Aug 23, 2024Storm⚡️Watch | Tech Giants Stumble: Georgia Tech Sued, Solar Winds Leaks, and Freaky Friday KEV Drops. Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026